CVE-2025-10409 in Student Grading System
Summary
by MITRE • 09/15/2025
A weakness has been identified in SourceCodester Student Grading System 1.0. This affects an unknown part of the file /rms.php?page=users. Executing manipulation of the argument fname can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2025
The vulnerability identified in SourceCodester Student Grading System version 1.0 represents a critical sql injection flaw within the application's user management functionality. This weakness exists in the /rms.php?page=users endpoint where the fname parameter is improperly handled, creating an avenue for malicious actors to manipulate database queries through crafted input. The vulnerability's classification as a remote exploit means that attackers can leverage this weakness without requiring physical access to the system or local network presence, significantly expanding the potential attack surface.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization practices within the application's php code. When the fname parameter is passed through the url query string to the rms.php page, the application fails to properly escape or parameterize user-supplied data before incorporating it into sql queries. This allows an attacker to inject malicious sql code that can be executed by the database engine, potentially leading to unauthorized data access, modification, or deletion. The weakness aligns with CWE-89 which specifically addresses sql injection vulnerabilities where untrusted data is incorporated into sql commands without proper sanitization.
The operational impact of this vulnerability extends beyond simple data compromise, as it provides attackers with potential access to sensitive student information, grading records, and user credentials stored within the database. The public availability of exploit code significantly reduces the barrier to entry for malicious actors, making this vulnerability particularly dangerous in environments where the application may be exposed to untrusted networks or users. Attackers could potentially escalate privileges, create backdoor accounts, or extract confidential information that could be used for identity theft, academic fraud, or further network infiltration.
Security mitigation strategies should focus on immediate implementation of proper input validation and parameterized queries to prevent sql injection attacks. The application should be updated to use prepared statements or stored procedures that separate sql code from user input, effectively neutralizing the vulnerability. Additionally, implementing proper access controls, input sanitization, and output encoding measures will help protect against similar weaknesses. Organizations should also consider implementing web application firewalls and regular security assessments to identify and remediate similar vulnerabilities throughout their application infrastructure. This vulnerability demonstrates the critical importance of following secure coding practices and adhering to industry standards such as those outlined in the OWASP Top Ten project and MITRE ATT&CK framework for preventing common web application vulnerabilities.